Authentication Bypass in NATS-Server Affects NATS.io Messaging System
CVE-2026-33248
What is CVE-2026-33248?
NATS-Server, a robust messaging system for cloud and edge applications, is susceptible to an authentication bypass issue prior to versions 2.11.15 and 2.12.6. This vulnerability arises when mTLS is used for client identity verification, particularly when using the verify_and_map function to derive NATS identities from the Subject DN of client certificates. Certain rare patterns of RDN may not be strictly enforced, leading to potential authentication bypass. While exploitation requires a valid client certificate from a trusted CA and involves highly improbable DN naming patterns, administrators with particular attention to these configurations should assess their security practices. Upgrading to versions 2.11.15 or 2.12.6 is strongly recommended to mitigate this issue. Alternatively, a review of CA issuance policies may help address potential vulnerabilities.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
nats-server < 2.11.15 < 2.11.15
nats-server >= 2.12.0-RC.1, < 2.12.6 < 2.12.0-RC.1, 2.12.6